CVE-2026-104724 in FireBox Plugin
Summary
by MITRE • 10/10/2026
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On fresh installations of version 3.1.10 and later, exploitation requires administrator-level access; however, on sites upgraded from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants the edit_fireboxes capability to any role that previously held edit_posts, reducing the minimum required privilege to Author-level.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The FireBox – WooCommerce Popup Builder plugin for WordPress contains a critical SQL injection vulnerability within its Form Display Condition feature, affecting all versions up through 3.1.13. This flaw stems from insufficient input validation and sanitization of user-supplied parameters that are directly incorporated into database queries without proper escaping or the use of prepared statements. The technical nature of this defect allows an attacker to manipulate SQL query structures by appending malicious payloads, thereby bypassing intended logic constraints and executing arbitrary commands against the underlying database server. This represents a classic instance of improper neutralization of special elements used in an SQL command, aligning with CWE-89 within standard vulnerability classification frameworks.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and system compromise. An attacker who successfully exploits this flaw can extract sensitive information stored in the WordPress database, including user credentials, personal customer data associated with WooCommerce transactions, and other proprietary site content. The ability to append additional SQL queries means that beyond simple data retrieval, an attacker could potentially modify or delete existing records, leading to integrity violations and potential denial of service conditions if critical tables are corrupted. This aligns with the ATT&CK technique for Database Credential Dumping and Data Exfiltration over alternative protocols such as SQL injection-based extraction methods.
A crucial aspect of this vulnerability is its varying exploitation requirements depending on the installation history of the affected site. On fresh installations starting from version 3.1.10, an attacker must possess administrator-level access to exploit the flaw due to stricter default capability assignments. However, for sites that were upgraded from versions prior to 3.1.10, a specific migration function named preserveCampaignRoleAccess() inadvertently grants the edit_fireboxes capability to any user role that previously held the edit_posts permission. This legacy behavior significantly lowers the barrier to entry, allowing authenticated attackers with author-level access and above to trigger the vulnerability without needing full administrative privileges. This discrepancy highlights the risks associated with backward compatibility migrations in plugin updates, where security postures can be inadvertently weakened for existing users while remaining secure for new installations.
To mitigate this risk, site administrators should immediately update the FireBox – WooCommerce Popup Builder plugin to version 3.1.14 or later, which addresses these input handling deficiencies by implementing proper parameterized queries and stricter capability checks. For sites upgraded from older versions, it is advisable to audit user roles and capabilities to ensure that author-level users do not retain unnecessary edit_fireboxes permissions if they are not required for their operational functions. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests targeting the plugin endpoints. Regular security audits and adherence to secure coding practices involving prepared statements will prevent similar vulnerabilities from recurring in future updates or related plugins.